Change GRUB bootloader identity from GRUB to FWS to match kickstart configuration.
Add signing of both primary (\EFI\FWS\grubx64.efi) and fallback removable
(\EFI\BOOT\BOOTX64.EFI) boot paths, as these are the paths actually loaded
by the firmware.
Extract GRUB_MODULES to a variable for reuse in both standard and removable
installation commands. Add objdump availability check before attempting SBAT
verification. Add sbat.csv existence check before reinstalling GRUB.
Add a new script that prepares FWS to boot signed under Secure Boot without enabling kernel lockdown, preserving hibernation capability.
The script:
- Checks UEFI firmware availability
- Installs sbctl if needed
- Locates ESP and GRUB EFI binary
- Reinstalls GRUB with SBAT section if missing
- Creates and enrolls sbctl keys while preserving Microsoft keys
- Signs GRUB and available kernel images
- Provides instructions for manual firmware setup steps
- Enables automatic re-signing after kernel/GRUB updates via pacman hooks
This allows FWS to meet Vanguard's Secure Boot requirement without sacrificing hibernation support.
nocode
